3 ms·

When I installed this, it wanted me to "Allow Full Access", which then came up with a pop-up from iOS saying: "Full access allows the developer of this keyboard

by zatkin 10y ago

When I installed this, it wanted me to "Allow Full Access", which then came up with a pop-up from iOS saying: "Full access allows the developer of this keyboard to transmit anything you type, including things you have previously typed with this keyboard. This could include sensitive information such as your credit card number or street address." This seems pretty sketchy.

notatoad 10y ago
I'm not sure how this keyboard could work any other way - the whole value prop is that you can search from the keyboard, and it would be pretty hard to send your search queries to google if it couldn't send the things you type to google. the app store description is pretty clear on what it actually sends to google, and it's actually less than what most keyboards send - swype, the standard google keyboard on android, and i think most others send everything up to their respective servers so they can sync personalized predictions across devices, this keyboard only sends the queries that you explicitly ask google to search for.
- fuzzywalrus 10y ago
  That seems antithetical to the Apple statement about "This could include sensitive information such as your credit card number or street address." Anyway to confirm the only keystroke that google can access are the ones submitted to its search query?
  - notatoad 10y ago
    Apple only has one permission level for keyboards that send stuff over the network: full permission. There's no way to determine what exactly they send using apple's keyboard permissions API, and apple doesn't know what they send. They just know it's a keyboard that can send anything you type over the network, and warn you accordingly. You have to either trust that google isn't flat-out lying, or try to MITM and analyze the traffic using something like wireshark, which would be difficult assuming it's properly encrypted.
csmajorfive 10y ago
You're typing into their keyboard. What do you expect?
blake8086 10y ago
How is a keyboard going to not know what you type or look up things on the internet without having internet access?
westernmostcoy 10y ago
Apple's third party keyboard message might be surprising, sure. It should probably not surprise you that the authors of your keyboard software are theoretically capable of seeing what you type on your keyboard though, if you think about it.
philsnow 10y ago
You don't have to "allow full access" to use it as simply a swiping keyboard. It's a better keyboard than Swype, even with "full access" turned off. I don't care about gifs or emojis. One of the only things I miss on iOS as an ~8-year user of Android is the swiping keyboard. This gets you that. Additionally, I think the privacy of using this keyboard without "full access" is better than using the android builtin keyboard. Unless google is doing some side-channel attack (is this possible? seems harder than on android) to funnel your keystrokes out through some other google app on your phone which does have internet access, it's just a dumb keyboard. Now, the sketchiness of guiding users to turn on "allow full access" by default... well. It would be paternalistic for me (as an armchair privacy enthusiast) to say "google shouldn't be encouraging the general population to divulge their keystrokes".
banku_brougham 10y ago
It may be the only way, but I'm still concerned by this. User @colinbartlett above says Google explicitly states what is sent, however. So am I right that it looks like we are trusting Google with what they say they are sending? I'm ok with that, I think.

by zatkin 10y ago

notatoad 10y ago

I'm not sure how this keyboard could work any other way - the whole value prop is that you can search from the keyboard, and it would be pretty hard to send your search queries to google if it couldn't send the things you type to google. the app store description is pretty clear on what it actually sends to google, and it's actually less than what most keyboards send - swype, the standard google keyboard on android, and i think most others send everything up to their respective servers so they can sync personalized predictions across devices, this keyboard only sends the queries that you explicitly ask google to search for.

fuzzywalrus 10y ago
That seems antithetical to the Apple statement about "This could include sensitive information such as your credit card number or street address." Anyway to confirm the only keystroke that google can access are the ones submitted to its search query?
- notatoad 10y ago
  Apple only has one permission level for keyboards that send stuff over the network: full permission. There's no way to determine what exactly they send using apple's keyboard permissions API, and apple doesn't know what they send. They just know it's a keyboard that can send anything you type over the network, and warn you accordingly. You have to either trust that google isn't flat-out lying, or try to MITM and analyze the traffic using something like wireshark, which would be difficult assuming it's properly encrypted.

csmajorfive 10y ago

You're typing into their keyboard. What do you expect?

blake8086 10y ago

How is a keyboard going to not know what you type or look up things on the internet without having internet access?

westernmostcoy 10y ago

Apple's third party keyboard message might be surprising, sure. It should probably not surprise you that the authors of your keyboard software are theoretically capable of seeing what you type on your keyboard though, if you think about it.

philsnow 10y ago

You don't have to "allow full access" to use it as simply a swiping keyboard. It's a better keyboard than Swype, even with "full access" turned off. I don't care about gifs or emojis. One of the only things I miss on iOS as an ~8-year user of Android is the swiping keyboard. This gets you that. Additionally, I think the privacy of using this keyboard without "full access" is better than using the android builtin keyboard. Unless google is doing some side-channel attack (is this possible? seems harder than on android) to funnel your keystrokes out through some other google app on your phone which does have internet access, it's just a dumb keyboard. Now, the sketchiness of guiding users to turn on "allow full access" by default... well. It would be paternalistic for me (as an armchair privacy enthusiast) to say "google shouldn't be encouraging the general population to divulge their keystrokes".

banku_brougham 10y ago

It may be the only way, but I'm still concerned by this. User @colinbartlett above says Google explicitly states what is sent, however. So am I right that it looks like we are trusting Google with what they say they are sending? I'm ok with that, I think.